The study "SME Cybersecurity 2026", published on 22 October 2026, shows that 6% of Swiss small and medium-sized enterprises (SMEs) have suffered a serious cyberattack in the past three years. Conducted by Mobiliar with digitalswitzerland, universities and the Federal Office for Cybersecurity (FOCS), it also finds that 7% of SMEs have already been victims of extortion. And 81% expect greater threats as a result of artificial intelligence (AI).

What the study measures

The survey is based on the responses of 507 managers of SMEs with 1 to 49 employees. YouGov Switzerland interviewed them from 24 June to 10 July 2026. According to the authors, the results are representative of around 614,400 SMEs, across all language regions.

This is the seventh edition of an annual series launched in 2020. Mobiliar runs it with digitalswitzerland, the University of Applied Sciences and Arts Western Switzerland (HES-SO) Valais-Wallis, the HWZ University of Applied Sciences in Business Administration Zurich and the Swiss Academy of Engineering Sciences (SATW). The FOCS supports the project.

The key figures of the 2026 edition

  • 6% of SMEs suffered a serious cyberattack in three years, or more than 35,000 companies according to the authors' extrapolation.
  • Among SMEs with at least ten employees, this share reaches up to 16%.
  • 7% have already been victims of extortion, or around 45,000 SMEs; a few even paid a ransom.
  • 88% consider cybercrime a serious problem.
  • 45% consider cybersecurity important or very important, compared with 33% in 2025.
  • Only a quarter regularly test restoring their backups.

Extortion mainly affects the largest SMEs, as well as industry and construction, the study specifies.

An increase to be read with caution

The share of SMEs affected is up compared with the two previous editions. It stood at 4% in 2024 as in 2025, and rises to 6% in 2026.

Indicator202420252026
SMEs surveyed526515507
Serious cyberattack in three years4%4%6%
Cybersecurity considered important or very important–33%45%

The dash indicates a figure that our sources do not provide. The definition of a serious attack is broad. It covers financial or reputational damage, a major recovery effort or a heavy emotional burden. Only attacks known to the companies are counted.

Our analysis: with around 500 respondents per edition, a two-point gap remains modest. The study does not specify whether it is statistically significant. The clearest trend concerns rather the importance attached to the subject, which is rising again after a decline the previous year.

AI worries, but remains little used

Four SMEs out of five think that AI will increase the threat. The authors consider it plausible that cybercriminals will use it for their attacks.

The paradox lies in another figure: nearly half of SMEs have not yet launched any AI project. AI therefore appears both as an economic opportunity and as an additional risk.

The gap between perception and action is also visible in the responses. 80% of managers say they are aware of the threats, and 66% believe that protective measures reduce the danger. But only 36% consider these measures easy to implement.

Well protected technically, less prepared organisationally

Swiss SMEs have good technical foundations, according to the study. More than 80% install updates, nine out of ten make backups, and multi-factor authentication is common.

The gap lies in organisation. Only around a third of SMEs regularly train their staff or keep an inventory of their IT systems. Emergency plans, security audits and checks on suppliers' security remain much less widespread.

"It is not enough to back up data. SMEs must regularly test whether they can quickly resume operations after a cyberattack," stresses Anu Anthamatten, project manager at digitalswitzerland.

Supplier risk is far from theoretical. At the end of September 2026, an attack on a software supplier made it possible to steal data from the Zurich pension fund. Two Bernese pension funds also lost data through an external service provider.

What an attack costs

A cyberattack costs time and energy first, more than money. Among the 44 affected SMEs in the sample, the major recovery effort and the emotional burden come first, with 16 mentions each. They are followed by financial damage, with 10 mentions, then weakened business relationships, reputation and the loss of customer data.

There is no typical attack. Phishing, password theft, malware and attacks on networks and servers each play a role in around a third of incidents. The consequences are significantly heavier in companies with at least ten employees.

"Cybercrime has become a real business risk for Swiss SMEs," sums up Jesús Pampín, head of the cyber risk competence centre at Mobiliar. For him, cyber protection matters as much as protection against fire or natural hazards. "Cyber insurance can mitigate risks, but it does not replace personal responsibility."

What an SME can do

The authors see a positive sign: more SMEs are appointing someone responsible for cybersecurity. The subject is becoming a matter for management, and no longer just for the IT department. Around two SMEs out of five plan new security measures over the next three years.

"Cybersecurity does not start with the firewall, but with a clear digital strategy," says Marc K. Peter, professor at HES-SO Valais-Wallis and project leader. According to the study, the most digitally advanced SMEs rate their resilience significantly higher.

The avenues drawn from the study come down to a few steps, which complement the basics of SME cybersecurity:

  • appoint a person responsible at management level;
  • test restoring backups, not just make them;
  • train staff regularly, particularly on phishing;
  • prepare an emergency plan and keep an inventory of systems;
  • check suppliers' IT security.

In the event of an incident, the FOCS receives voluntary reports and runs an on-call line 24h/24. According to the study, 40% of SMEs would be prepared to report an incident to it. Its Cybersecurity Hub, designed primarily for critical infrastructure, remains open to SMEs, but only around 7% use it. Further resources can be found in our section protecting your business.

"Information, prevention and cooperation are pillars of a resilient cyber landscape," notes Romain Geiser, programme manager at the FOCS.

What we do not yet know

The excerpts consulted do not give a precise figure for the share of SMEs with an emergency plan, an audit or supplier checks. Nor do they give the amount of ransoms paid or the number of companies that paid. The full results have been available since 22 October 2026 on the study's website, in four languages.

Sources